CVE-2026-63747: SurrealDB DoS Vulnerability

CVE-2026-63747 Overview

CVE-2026-63747 is a denial of service vulnerability affecting SurrealDB versions prior to 3.1.0. The flaw resides in the Remote Procedure Call (RPC) use handler, which panics when the db parameter is set without a corresponding namespace. Unauthenticated attackers can send a single malformed WebSocket message to the /rpc endpoint to crash the server process. The vulnerability is tracked under [CWE-248] Uncaught Exception and is documented in the GitHub Security Advisory GHSA-wjjj-24cx-f28g.

Critical Impact
Unauthenticated network attackers can crash SurrealDB instances by sending a single malformed WebSocket RPC message, terminating availability of the database service.

Affected Products

SurrealDB versions prior to 3.1.0
Deployments exposing the /rpc WebSocket endpoint to untrusted networks
Applications relying on SurrealDB as a backend datastore

Discovery Timeline

2026-07-20 - CVE-2026-63747 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-63747

Vulnerability Analysis

SurrealDB exposes an RPC interface over WebSockets at the /rpc endpoint. Clients invoke the use method to select an active namespace and database context for subsequent queries. The handler assumes that when a db value is supplied, a namespace value is also present. When a client submits a request containing only the db field, the handler triggers an uncaught panic in the server process. Because the panic propagates through the async runtime handling the connection, the entire server process terminates. No authentication is required to reach the vulnerable code path, since the use method is available before any session credentials are validated.

Root Cause

The root cause is missing input validation on the use RPC parameters combined with a hard unwrap or equivalent panic path when the namespace is absent. This corresponds to [CWE-248] Uncaught Exception. The handler does not return a structured error to the client and instead terminates the thread of execution, which propagates to a full process crash.

Attack Vector

Exploitation requires only network access to the /rpc WebSocket endpoint. The attacker opens a WebSocket connection and sends a single JSON-RPC message invoking the use method with a db value and no namespace value. The server panics on message deserialization and processing, terminating availability. No credentials, user interaction, or prior state are required. See the VulnCheck Advisory for SurrealDB for additional technical context.

Detection Methods for CVE-2026-63747

Indicators of Compromise

Unexpected termination of the surreal server process with panic messages in stdout or systemd journal logs
WebSocket connections to /rpc from unknown external sources immediately preceding a service crash
JSON-RPC use method invocations containing a db field without a namespace field
Repeated automatic restarts of the SurrealDB process by supervisors such as systemd or container orchestrators

Detection Strategies

Parse SurrealDB stdout and stderr for Rust panic strings such as thread 'main' panicked correlated with WebSocket activity
Inspect reverse proxy or load balancer logs for WebSocket upgrade requests to /rpc followed by abrupt backend disconnects
Deploy web application firewall rules to flag JSON-RPC bodies where the use method is called with a db key but no namespace key

Monitoring Recommendations

Alert on SurrealDB process restarts and crash-loop conditions in container platforms and process supervisors
Track connection reset counts and 5xx responses from any reverse proxy fronting the /rpc endpoint
Monitor availability metrics and health check failures for SurrealDB pods or instances

How to Mitigate CVE-2026-63747

Immediate Actions Required

Upgrade SurrealDB to version 3.1.0 or later on all instances
Restrict network exposure of the /rpc endpoint to trusted client networks only
Place SurrealDB behind an authenticated reverse proxy or service mesh that terminates untrusted WebSocket traffic
Enable automatic restart supervisors to reduce downtime while patching is scheduled

Patch Information

SurrealDB has released version 3.1.0 which addresses the panic in the use RPC handler. Refer to the GitHub Security Advisory GHSA-wjjj-24cx-f28g for release notes and remediation guidance. All deployments running versions earlier than 3.1.0 should upgrade promptly.

Workarounds

Block external access to the /rpc WebSocket endpoint using firewall rules or ingress policies until patching is complete
Deploy a WAF rule that rejects JSON-RPC bodies invoking use with a db field and no namespace field
Require mutual TLS or authenticated proxying in front of SurrealDB to prevent unauthenticated clients from reaching the vulnerable handler

bash

# Example ingress restriction: allow only internal CIDR to reach /rpc
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP

# Upgrade SurrealDB to the patched release
curl -sSf https://install.surrealdb.com | sh -s -- --version v3.1.0
surreal version